Orkes Conductor unauthenticated RCE via inline workflow definitions
Unauthenticated RCE in Orkes Conductor via crafted inline workflow definitions. CVSS 9.8 critical; active exploitation confirmed.
- Vendor
- Orkes
- Product
- Orkes Conductor
- CVSS
- 9.8
- EPSS (exploit probability)
- 9.1%
- Status
- exploited-in-wild
- Published
Is CVE-2026-58138 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-58138 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-04 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 9.1% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-04. Full cross-catalog view: /kev-comparison
CVE-2026-58138 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
An unauthenticated attacker can execute arbitrary code on Orkes Conductor servers by submitting crafted inline workflow definitions to the API. No authentication is required to trigger the flaw.
Active exploitation was confirmed by SecurityWeek as of September 17, 2026. Refer to the NVD entry and the Orkes security advisory for specific affected version ranges and available patches. If a patch is not yet available in your environment, restrict network access to the Conductor API to trusted sources and treat any anomalous workflow execution as a potential incident.
